If your client details sit in a spreadsheet or a notepad outside your main system, the risk is not the file. It is that nobody controls who sees it, copies it or deletes it. Find out why staff built it, then fix the system so they don't need it.
That is the short answer. The longer one starts with the person who built it.
I have led teams since 2005, mostly in non-profits, across eight sectors. One of the first things I look for when I walk in is sensitive client information saved somewhere it should not be. A notepad file on a desktop. An Excel sheet on a shared drive. Names, phone numbers, notes about someone's situation. All of it sitting outside the system that was bought to protect it.
Nobody did this to be careless. They did it to get the work done.
Why does client data end up in a spreadsheet?
Because the official system did not do something the job needed. It took too long to find a client. It had no field for the thing everyone needed to know. The report would not give a simple list of who was due a call this week. So somebody made a list.
I wrote about this in the workaround. The workaround is the real requirements document. The official process is the draft. The spreadsheet is the most honest description you will get of how the work actually runs.
That is the useful part. The risky part is that the honest description now holds personal information, and nobody is looking after it.
Does the Privacy Act apply to my not-for-profit?
It depends on your organisation. Some not-for-profits are covered and some are not, and the answer turns on things like what you do and what kind of information you hold.
I am not a lawyer, and this is not legal advice. The Office of the Australian Information Commissioner (OAIC) is the place to check. Start with its page on privacy for not-for-profits, including charities. If you are still unsure, ask someone qualified.
Here is the part I can speak to. Whether or not the Act covers you, your clients trusted you with their details. That trust does not have an exemption.
What happens if a spreadsheet with client details goes missing?
Usually nobody knows straight away. That is the problem.
A file in the main system has an owner, access controls and some record of who opened it. A file on a desktop has none of that. It gets emailed to a personal account so someone can work from home. It gets copied to a USB stick. It stays on a laptop after the person leaves. When something goes wrong, you cannot say who had it, what was in it or how many people are affected.
A data breach is when personal information is lost, or seen or used by someone who should not have it. Some breaches have to be reported. Whether that applies to you is a question for the OAIC, and its Notifiable Data Breaches page explains the scheme.
There is a quieter cost too. In a health service I worked in, every team had its own way of doing things. The impact was long delays and wait times, and lost information. Patients had to keep repeating themselves. Nobody was being careless. The information was simply in too many places.
Why banning the spreadsheet usually makes it worse
The common response is a crackdown. Someone finds the file, calls it a risk and sends an email saying all client information must stay in the system.
The work has not changed, so the need has not changed. The spreadsheet moves somewhere harder to find. Now you have the same risk, less visibility and a team that has learned not to tell you things.
A ban treats the person as the problem. Usually that person is the one who understood the work best.
How to move the data without losing what the spreadsheet was doing
Sit with the person who built it. Ask them to walk you through a real week. Ask why each column is there. Every column is a job the system was not doing.
Then make the system do those jobs. Add the field. Build the simple list. Cut the steps. Where the system cannot do it, choose something that can and that keeps the information inside a controlled place.
Only then move the data across, check it with the person who kept it, and delete the old copies. All of them, including the one in someone's email.
In that health service, the fix was one unified, streamlined information system. Everybody knew what was going on and where the information was. Patients felt acknowledged. Frustration went down and satisfaction went up. The data was safer because it lived in one place, but that was not why people used it. They used it because it worked.
What to ask your team this week
You do not need an audit to start. You need a few honest conversations.
- Where do you keep client information that is not in the main system?
- What does that file do that the system does not?
- Who else has a copy?
- If you left tomorrow, would anyone know it exists?
Ask without blame, or you will get polite answers. The first sign in my free guide, "7 signs your system is quietly failing", is "Everybody has their own way of doing it." A private spreadsheet is that sign in its simplest form. If the answers worry you, that is worth knowing now rather than later.
Frequently asked questions
Is it illegal to keep client details in Excel?
The law is about how you protect and handle personal information, not which tool you use. A spreadsheet is not the issue on its own. Who can see it, copy it and lose it is. Check the OAIC guidance for your situation.
Do small charities have to report data breaches?
It depends on whether the Privacy Act covers your organisation. The OAIC's Notifiable Data Breaches page explains the scheme and who it applies to.
What should replace the spreadsheet?
Whatever does the job the spreadsheet was doing, inside a controlled system. Find the job first. The tool comes second.